Fix all 26 npm audit vulnerabilities (1 critical) + align Playwright image

[stretchcloud]

Stacked on #12 (both PRs touch package-lock.json; stacking avoids a lockfile conflict). Merge #12 first — GitHub will retarget this PR to main automatically.

Problem

npm audit: 26 vulnerabilities — 1 critical, 14 high, 7 moderate, 4 low.

The critical is form-data 4.0.2 (predictable multipart boundary GHSA-fjxv-7rqg-78g4, CRLF injection GHSA-hmw2-7cc7-3qxx). The highs cluster on axios (29 advisories: SSRF via NO_PROXY bypass, prototype-pollution gadgets, DoS), playwright (browser downloads without SSL verification), undici, ws, validator, lodash.

Fix

Every advisory was fixable within existing semver ranges — so package.json is untouched and this is a lockfile-only refresh:

• npm audit fix (25 of 26)
• npm update minimatch for the one copy the fix pass left behind (9.0.5 → 9.0.9)

package	before	after
form-data ⚠️ critical	4.0.2	4.0.6
axios	1.9.0	1.18.1
playwright	1.52.0	1.61.1
express	4.21.2	4.22.2
bullmq	5.49.2	5.80.10
undici / ws / qs / validator / uuid / …	—	patched

Plus one deliberate non-lockfile change: the Dockerfile pins the Playwright base image by version, and the audit bump moved the library to 1.61.1 — with the old v1.52.0-jammy image the container would no longer have the browser builds the library looks for, breaking every browser launch. Bumped the image to v1.61.1-jammy (tag verified on MCR) to keep them paired.

Verification

• npm audit → 0 vulnerabilities
• tsc ✅ · eslint ✅ · 180/180 tests ✅ · openapi:check in sync ✅
• Docker end-to-end smoke test on the built image:
  • Chromium 149 launches under Playwright 1.61.1 inside the container
  • App boots against Redis — BullMQ 5.80 queues initialize
  • /health UP, /health/ready READY
  • POST /api/scrape succeeds on both the browser path and the HTTP (axios) path

🤖 Generated with Claude Code